{"record":{"id":"bf6e7cea81e97d4e","repo":"slackhq/nebula","slug":"entry-v-route-in-tun-unsafe-routes-is-contained-w","errorCode":null,"errorMessage":"entry %v.route in tun.unsafe_routes is contained within the configured vpn networks; route: %v, network: %v","messagePattern":"entry (.+?)\\.route in tun\\.unsafe_routes is contained within the configured vpn networks; route: (.+?), network: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/route.go","lineNumber":297,"sourceCode":"\t\t\t\treturn nil, fmt.Errorf(\"entry %v.install in tun.unsafe_routes is not a boolean: %v\", i+1, err)\n\t\t\t}\n\t\t}\n\n\t\tr := Route{\n\t\t\tVia:     gateways,\n\t\t\tMTU:     mtu,\n\t\t\tMetric:  metric,\n\t\t\tInstall: install,\n\t\t}\n\n\t\tr.Cidr, err = netip.ParsePrefix(fmt.Sprintf(\"%v\", rRoute))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"entry %v.route in tun.unsafe_routes failed to parse: %v\", i+1, err)\n\t\t}\n\n\t\tfor _, network := range networks {\n\t\t\tif network.Contains(r.Cidr.Addr()) {\n\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\"entry %v.route in tun.unsafe_routes is contained within the configured vpn networks; route: %v, network: %v\",\n\t\t\t\t\ti+1,\n\t\t\t\t\tr.Cidr.String(),\n\t\t\t\t\tnetwork.String(),\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\n\t\troutes[i] = r\n\t}\n\n\treturn routes, nil\n}\n\nfunc ipWithin(o *net.IPNet, i *net.IPNet) bool {\n\t// Make sure o contains the lowest form of i\n\tif !o.Contains(i.IP.Mask(i.Mask)) {\n\t\treturn false","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/route.go#L279-L315","documentation":"Config safety check in parseUnsafeRoutes: the i+1-th unsafe route's CIDR lies inside one of the configured VPN networks (network.Contains(route.Addr())). Routing the overlay's own address space back through a gateway would create a loop, so the whole config is rejected with both the route and the containing network named.","triggerScenarios":"Thrown at overlay/route.go:297 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Exclude the VPN's own subnets from tun.unsafe_routes","Narrow the route to traffic outside the overlay networks","Adjust the unsafe route CIDR so it does not fall inside any configured network"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}